General
- Target 2026-07-19_5740e687de8d7cc9374e440d8ba5f412_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- Sample260719-2h875ahs2v
- SHA256 82e7d410e19822fc81e3425d42dbf1ba621cfeb6a22f6d83a982152601074446
- MD5 5740e687de8d7cc9374e440d8ba5f412
- SHA1 c8050b634a9c6f04f0877d217715b789a12fdb7b
- SHA512 462c40763559f9b5b456c6fcd87e175897049e203f2e31207de6c3bea7017f28c5521d646c7710068c0236ac6b661e3f9bdd82b508ce6590d491e33b927c988f
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeU:UIfjoga66AVDKUTbQIzFLwLU
- TLSH T135850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-07-19_5740e687de8d7cc9374e440d8ba5f412_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
8 signatures
150 seconds
Malware Config
Extracted
Family
-
urelas
C2
-
218.54.31.165
-
218.54.31.226
Targets
-
- Target 2026-07-19_5740e687de8d7cc9374e440d8ba5f412_amadey_elex_glassworm_njrat_rhadamanthys_smoke-loader_stealc_stop_tofsee
- Size 1.6MB
- SHA256 82e7d410e19822fc81e3425d42dbf1ba621cfeb6a22f6d83a982152601074446
- MD5 5740e687de8d7cc9374e440d8ba5f412
- SHA1 c8050b634a9c6f04f0877d217715b789a12fdb7b
- SHA512 462c40763559f9b5b456c6fcd87e175897049e203f2e31207de6c3bea7017f28c5521d646c7710068c0236ac6b661e3f9bdd82b508ce6590d491e33b927c988f
- SSDEEP 12288:UIfBoDWoyFblU6hAJQnOzer5+nILwA1YaL8i0DMUNLtG4+tbQIzKYZLwLaYJOXeU:UIfjoga66AVDKUTbQIzFLwLU
- TLSH T135850757EB814AE8E35D09365B588150D62EFE21A64F2350B46C721CCFA33878F66E3D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE